Detection of RMM Software Deployment via Internet-Originated MSI Files

Security analysts have observed an increase in threat actors leveraging legitimate Remote Monitoring and Management (RMM) tools as a primary means of establishing persistent, unauthorized remote access to victim environments. Attackers often deliver these tools through social engineering campaigns, where users are induced to download and run seemingly benign MSI installers from the internet. When executed, these packages deploy various RMM agents that grant the actor full administrative control over the compromised endpoint.

Because RMM tools are dual-use software, their presence is not inherently malicious, complicating detection efforts. This intelligence focuses on identifying the specific activity chain where a file of type .msi, originating from a non-reputable internet location, is executed via the Windows Installer process (msiexec.exe), followed shortly by the creation of known RMM-related service or agent executables. Defenders should treat such sequences as potential unauthorized persistence attempts, particularly when the installation was not initiated through managed IT or internal software distribution channels.

Impact

Successful deployment of RMM tools by unauthorized actors leads to complete loss of confidentiality and integrity on the impacted host. Attackers use these tools for file exfiltration, remote command execution, and as a springboard for further lateral movement within corporate networks. These campaigns have been observed across various sectors as attackers aim to maintain long-term, stealthy access to internal resources.

Recommendation

Detection engineering teams should implement monitoring for the specific sequence of MSI execution followed by RMM agent creation.

• Deploy the provided ESQL detection logic to identify the correlation between internet-sourced MSI downloads and RMM binary creation.
• Establish a baseline for authorized IT RMM deployment to differentiate legitimate administrative activity from unauthorized installations.
• Block or monitor downloads from untrusted domains that frequently host these installers, particularly those outside of known developer artifact and cloud storage services.
• Audit endpoint logs to verify the parent process for all msiexec.exe executions to ensure they align with established software deployment policies.